GICodeWarrior

3 か月前議論

ctrl+mouse wheel triggers the application zoom in most cases. However, if my mouse is over the scrollable node, it invokes the Google Chrome window zoom (so I end up with two competing zoom transforms). It also zooms relative to the upper left corner, rather than relative to my cursor (seems the app doesn't support panning?). The background dots also move and change size as I zoom (subtle but somewhat distracting).

GICodeWarrior

昨年議論

If you're interested to explore lots of XSS edge cases, I've found this CTF to be enjoyable.

https://alf.nu/alert1

GICodeWarrior

昨年議論

Encoding for each scenario can be quite complex unfortunately. Django does have some template filters to help.

I recommend following the documentation carefully, and using a JSON API or other similarly standard mechanism if the documented options are insufficient.

GICodeWarrior

昨年議論

Simple JSON encoding alone is not sufficient if you put the output into a <script> tag.

<script>const user_input = "</script><script>alert(1)//"; ...

GICodeWarrior

昨年議論

The "How to use a Python variable in an external Javascript (Django)" examples are likely vulnerable to an XSS attack, when the variable contains user supplied content.

It's important to output-encode for the correct context. By default, Django encodes template variables for an HTML context, which can allow XSS when output inside a script tag or as a JavaScript file.

GICodeWarrior

4 年前議論

NPTv6 is different from IPv4 NAT and doesn't really have the same issues.

A different solution I've seen proposed for networks with multiple ISPs is to advertise both public prefixes to the network and let each client endpoint figure out which egress to use. This seems like a worse idea though.

The most official approach is to get your own public IPv6 prefix and work with your ISPs to BGP route that to you on both links. However, home and small business ISPs generally don't offer this.

GICodeWarrior

4 年前議論

Have you implemented NPTv6 before? What routing product(s) have you implemented this with? Do you happen to have some documentation links handy?

In my experience, this capability is missing from most off-the-shelf solutions, and in the cases where it is available, the documentation of this feature is missing or incomplete.

コメント